Analysis

  • max time kernel
    143s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/04/2024, 08:06

General

  • Target

    2024-04-18_ec037108d64d64dfe561c9900f421d2d_cryptolocker.exe

  • Size

    40KB

  • MD5

    ec037108d64d64dfe561c9900f421d2d

  • SHA1

    0202642e9bb37f7e843df817f4197da7163c6dfc

  • SHA256

    be217a543ee33bada0eaa1c490da6ab44ec8119f6225b4f934a3d30bb67aea56

  • SHA512

    24e3fbc26b0073e62bf8dd66ce6814837b625c24b3b8913b580953470d3a314beec27529a31aee6e870a970dd8d5e8c59cb503f8d27366127ad7b12ba670d70f

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4HKcfr4:X6QFElP6n+gJQMOtEvwDpjBsYK6r4

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-18_ec037108d64d64dfe561c9900f421d2d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-18_ec037108d64d64dfe561c9900f421d2d_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:3964
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4776

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\asih.exe

      Filesize

      40KB

      MD5

      f40c89da85854cbdada5597230023c1d

      SHA1

      e7a7c398aecf1fe1abff02094920a6412165cb93

      SHA256

      7d6e07ec4377ffa89c7b97c6f913bd9ea274b62a5ca87692cfe71ce65a5f66aa

      SHA512

      2477ac139ceba2a3ff34c934165aeef1452aef8e2390b154e28fc739015f2cb7073ff8721021f4c9b2b41ce48507b4cb9562535befc352f75121c70abc52eac4

    • memory/3964-18-0x00000000004F0000-0x00000000004F6000-memory.dmp

      Filesize

      24KB

    • memory/3964-17-0x00000000004D0000-0x00000000004D6000-memory.dmp

      Filesize

      24KB

    • memory/5080-0-0x0000000000700000-0x0000000000706000-memory.dmp

      Filesize

      24KB

    • memory/5080-1-0x0000000000700000-0x0000000000706000-memory.dmp

      Filesize

      24KB

    • memory/5080-2-0x0000000000720000-0x0000000000726000-memory.dmp

      Filesize

      24KB